K2

Vendor: Joomlaworks • 10 CVEs

CVEs (10)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-48946 1Joomlaworks 1K2 Jun 28, 2026 Jun 25, 2026 N/A· v4 6.3 MEDIUM· v3 N/A· v2 The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then f...Show more The K2 frontend article-attachment upload path accepts files whose extension is `.php`, and Apache's standard mod_php matches `\.php$` and executes them under the K2 web user. A K2 Author can upload a `shell.php`, then fetch `/media/k2/attachments/shell.php` and execute arbitrary PHP code in the web server's context.Show less
CVE-2026-48945 1Joomlaworks 1K2 Jun 28, 2026 Jun 25, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are ext...Show more The K2 article gallery upload path accepts a zip/tar archive, extracts it under `/media/k2/galleries/<id>/`, and only renames image files (gif/jpg/jpeg/png/webp) to safe names — non-image files (including `.php`) are extracted as-is and remain executable via direct HTTP access.Show less
CVE-2026-48944 1Joomlaworks 1K2 Jun 28, 2026 Jun 25, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list o...Show more The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list of source paths. An Author can therefore copy `configuration.php` (or any other file readable by the web user — including `../../../etc/passwd`) into `/media/k2/attachments/`, then retrieve the contents via the K2 attachment-download endpoint.Show less
CVE-2026-48943 1Joomlaworks 1K2 Jun 28, 2026 Jun 25, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary v...Show more K2 ≤ 2.24 contains a mass-assignment defect in the K2 system user plugin `plg_user_k2`. A Registered Joomla user, by including the field `K2UserForm=1` in a standard `com_users` `profile.save` POST, can write arbitrary values into the `notes`, `image`, and `plugins` columns of their own row in the `#__k2_users` table — none of which are exposed by the K2 frontend profile-edit form.Show less
CVE-2026-48942 1Joomlaworks 1K2 Jun 28, 2026 Jun 25, 2026 N/A· v4 6.1 MEDIUM· v3 N/A· v2 K2 ≤ 2.26 renders the `#__k2_users.image` column directly into HTML `src` attributes via two distinct templates, in both cases without HTML escaping.
CVE-2026-48941 1Joomlaworks 1K2 Jun 28, 2026 Jun 25, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`
CVE-2026-48940 1Joomlaworks 1K2 Jun 28, 2026 Jun 25, 2026 N/A· v4 3.4 LOW· v3 N/A· v2 A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the...Show more A Joomla user with K2 "create item" rights (Author tier by default) can submit an article whose `embedVideo` POST field contains a raw `<script>` tag; K2 stores it verbatim and renders it unescaped to any visitor of the article page.Show less
CVE-2019-19634 3Getk2 JoomlaworksVerot Project 3K2 K2Verot Jun 26, 2026 Dec 17, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-201...Show more class.upload.php in verot.net class.upload through 1.0.3 and 2.x through 2.0.4, as used in the K2 extension for Joomla! and other products, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.Show less
CVE-2019-19576 3Getk2 JoomlaworksVerot Project 3K2 K2Verot Jun 26, 2026 Dec 4, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 class.upload.php in verot.net class.upload before 1.0.3 and 2.x before 2.0.4, as used in the K2 extension for Joomla! and other products, omits .phar from the set of dangerous file extensions.
CVE-2018-7482 1Joomlaworks 1K2 Jun 17, 2026 Feb 28, 2018 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1_../configurati...Show more The K2 component 2.8.0 for Joomla! has Incorrect Access Control with directory traversal, allowing an attacker to download arbitrary files, as demonstrated by a view=media&task=connector&cmd=file&target=l1_../configuration.php&download=1 request. The specific pathname ../configuration.php should be base64 encoded for a valid attack. NOTE: the vendor disputes this issue because only files under the media-manager path can be downloaded, and the documentation indicates that sensitive information does not belong there. Nonetheless, 2.8.1 has additional blocking of .php downloadsShow less